3 ms·
While that may have been true in 2014, today it's hard to find an exploitable bug affecting a major image format parser in ImageMagick. Assuming you aren't usin
by microcolonel 10y ago
While that may have been true in 2014, today it's hard to find an exploitable bug affecting a major image format parser in ImageMagick. Assuming you aren't using unsanitized user-provided parameters on the command line with it, it should be fine unless your attacker is very motivated.
- nitrogen 10y agoThere was an RCE vulnerability this year: https://imagetragick.com/ https://imagetragick.com/
- tetromino_ 10y agoImageTragick did not affect major image formats; it was a vulnerability in the parser for ImageMagick's scripting languages [1]. The real problem was that support for scripting was enabled by default, and there was no obvious big red button to disable it. [1] Like MVG (http://www.imagemagick.org/script/magick-vector-graphics.php http://www.imagemagick.org/script/magick-vector-graphics.php) and MSL (http://www.imagemagick.org/script/conjure.php http://www.imagemagick.org/script/conjure.php)